Question

A company ingests VPC Flow Logs from 200 production VPCs into a centralized S3 bucket for security audits. The security team only needs to review rejected traffic and traffic to a small set of sensitive subnets, but the current configuration captures ALL traffic (ACCEPT and REJECT) at the default aggregation interval, generating multi-terabyte daily volumes and a large monthly bill. The team must reduce log storage and processing cost while still meeting the audit requirement of retaining all rejected connection records and all traffic to the sensitive subnets. Which approach BEST achieves this?

Accepted Answer

Create separate flow log subscriptions: one at the subnet level for the sensitive subnets capturing ALL traffic, and one at the VPC level configured with a filter of REJECT for the remaining scope, both delivered to S3.

Answer

Reduce the maximum aggregation interval from 10 minutes to 1 minute on all existing flow logs to compress the number of records generated.

Answer

Enable a single VPC-level flow log capturing ALL traffic but switch the destination from S3 to CloudWatch Logs with a metric filter that drops ACCEPT records.

Answer

Apply an S3 lifecycle policy that transitions all flow log objects to S3 Glacier Deep Archive after one day to lower storage cost.